Examkin

Soru

Zorluk: OrtaMicrosoft Entra ID Authentication and Conditional Access

Apex Aerospace is designing a Microsoft Entra ID identity strategy. The organization plans to implement a strict Conditional Access policy that requires Multi-Factor Authentication (MFA) for all administrative roles. The security team wants to ensure that administrators can still access the tenant to resolve configuration issues or during a cloud-based MFA service outage. Which design option should you recommend?

  1. A
    Configure all administrative roles as eligible for activation in Microsoft Entra Privileged Identity Management (PIM) and rely on the activation workflow without any Conditional Access policy exclusions.
  2. Create two dedicated emergency access accounts, assign them the Global Administrator role, and exclude them from the Conditional Access policies requiring MFA.Cevap
  3. C
    Deploy an Active Directory Federation Services (AD FS) infrastructure to federate the tenant, routing all administrator authentication requests to on-premises servers to bypass Azure MFA.
  4. D
    Configure all administrator accounts with permanently active role assignments in Privileged Identity Management (PIM) to ensure they bypass the need for elevation during a disaster.

Cevap

Create two dedicated emergency access accounts, assign them the Global Administrator role, and exclude them from the Conditional Access policies requiring MFA.
Creating dedicated emergency access accounts (break-glass accounts) and excluding them from the Conditional Access policies that enforce MFA ensures that administrators have a fallback mechanism to sign in and resolve configuration issues or outages without requiring MFA.

Adım Adım Çözüm

1
Analyze the lockout risk associated with enforcing MFA on all administrative accounts.
Identify that a service outage or misconfiguration affecting Microsoft Entra MFA would prevent all administrators from signing in.
This establishes the need for a bypass or recovery mechanism that does not depend on MFA.
2
Evaluate Microsoft's best practices for tenant emergency management.
Determine that Microsoft recommends creating at least two dedicated emergency access accounts (break-glass accounts) that are highly monitored, rarely used, and excluded from MFA requirements.
Excluding these accounts from Conditional Access MFA policies ensures they can authenticate even if the MFA service is entirely unavailable.
3
Select the option that aligns with the emergency access account configuration.
Select the option advocating for the creation and exclusion of emergency access accounts.
This meets the security and availability requirements without introducing unnecessary hybrid infrastructure like AD FS or violating least privilege via PIM active assignments.

Anahtar Kavram

Microsoft Entra ID emergency access accounts
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Microsoft Entra ID Authentication and Conditional Access